FreeRADIUS BlastRADIUS Vulnerability Advisory and Fix Guide

Key Information Vulnerability Name: BlastRADIUS Vulnerability Disclosure Date: July 9, 2024 Vulnerability Type: Protocol design flaw inherent in the RADIUS protocol, affecting all standard-compliant RADIUS clients and servers, regardless of specific implementation. Impact Scope: All standard-compliant RADIUS clients and servers — even those correctly implementing all aspects of the RADIUS protocol — may be vulnerable to attack. Attack Mechanism: - Exploits a design flaw in the RADIUS protocol to perform a "man-in-the-middle" attack by modifying Access-Request packets. - Highly complex attack requiring substantial CPU resources; no publicly available exploits currently exist. Attackers are likely limited to state-level actors. Mitigation Measures: - Immediately upgrade FreeRADIUS to version 3.0.27 or 3.2.5. - For all FreeRADIUS versions: - Set and . For standard RADIUS clients and servers, this provides protection in most cases. - For proxy server configurations, configure for relevant clients in . - For NAS devices, modify configurations in the and sections. - If upgrading FreeRADIUS is not possible, apply configuration-based mitigations, but upgrading to a non-EoL version is strongly recommended. Affected FreeRADIUS Versions: - Versions 2 and earlier cannot be patched. - While configuration options are available, long-term mitigation requires upgrading to a supported version. Resource Links: - Security Advisory: Engineering Whitepaper, FAQ, upgrade documentation, and tool details; Bridge Network. - Report Vulnerability: security email address. - RFC Recommended Fixes and Compliance Changes: RFC 5080 Section 2.2.2.

Goal Reached Thanks to every supporter — we hit 100%!

FreeRADIUS BlastRADIUS Vulnerability Advisory and Fix Guide